linux-kernel - Re: [RFC][PATCH 0/2] ftrace: Add access to function arguments for all callbacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201028213303.shosfclmhxkai2ir@ast-mbp.dhcp.thefacebook.com>
Date:   Wed, 28 Oct 2020 14:33:03 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     linux-kernel@...r.kernel.org,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Jiri Olsa <jolsa@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...nel.org>
Subject: Re: [RFC][PATCH 0/2] ftrace: Add access to function arguments for
 all callbacks

On Wed, Oct 28, 2020 at 09:15:42AM -0400, Steven Rostedt wrote:
> 
> This is something I wanted to implement a long time ago, but held off until
> there was a good reason to do so. Now it appears that having access to the
> arguments of the function by default is very useful. As a bonus, because
> arguments must be saved regardless before calling a callback, because they
> need to be restored before returning back to the start of the traced
> function, there's not much work to do to have them always be there for
> normal function callbacks.
> 
> The basic idea is that if CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS is set, then
> all callbacks registered to ftrace can use the regs parameter for the stack
> and arguments (kernel_stack_pointer(regs), regs_get_kernel_argument(regs, n)),
> without the need to set REGS that causes overhead by saving all registers as
> REGS simulates a breakpoint.

I don't have strong opinion on this feature, but if you want to have it
please add a giant disclaimer that this is going to be x86-64 and, may be arm64,
feature _forever_. On x86-32 and other architectures there is no way
to provide sane regs_get_kernel_argument(regs, n) semantics by blindly
saving registers. The kernel needs to know types and calling convention
of the architecture. That's the reason bpf side has btf_func_model concept.
To make sure that bpf trampoline can support all architectures in the future.